Detecting worm mutations using machine learning

Worms are malicious programs that spread over the Internet without human intervention. Since worms generally spread faster than humans can respond, the only viable defence is to automate their detection. Network intrusion detection systems typically detect worms by examining packet or flow logs for known signatures. Not only does this approach mean that new worms cannot be detected until the corresponding signatures are created, but that mutations of known worms will remain undetected because each mutation will usually have a different signature. The intuitive and seemingly most effective solution is to write more generic signatures, but this has been found to increase false alarm rates and is thus impractical. This dissertation investigates the feasibility of using machine learning to automatically detect mutations of known worms. First, it investigates whether Support Vector Machines can detect mutations of known worms. Support Vector Machines have been shown to be well suited to pattern recognition tasks such as text categorisation and hand-written digit recognition. Since detecting worms is effectively a pattern recognition problem, this work investigates how well Support Vector Machines perform at this task. The second part of this dissertation compares Support Vector Machines to other machine learning techniques in detecting worm mutations. Gaussian Processes, unlike Support Vector Machines, automatically return confidence values as part of their result. Since confidence values can be used to reduce false alarm rates, this dissertation determines how Gaussian Process compare to Support Vector Machines in terms of detection accuracy. For further comparison, this work also compares Support Vector Machines to K-nearest neighbours, known for its simplicity and solid results in other domains. The third part of this dissertation investigates the automatic generation of training data. Classifier accuracy depends on good quality training data -- the wider the training data spectrum, the higher the classifier's accuracy. This dissertation describes the design and implementation of a worm mutation generator whose output is fed to the machine learning techniques as training data. This dissertation then evaluates whether the training data can be used to train classifiers of sufficiently high quality to detect worm mutations. The findings of this work demonstrate that Support Vector Machines can be used to detect worm mutations, and that the optimal configuration for detection of worm mutations is to use a linear kernel with unnormalised bi-gram frequency counts. Moreover, the results show that Gaussian Processes and Support Vector Machines exhibit similar accuracy on average in detecting worm mutations, while K-nearest neighbours consistently produces lower quality predictions. The generated worm mutations are shown to be of sufficiently high quality to serve as training data. Combined, the results demonstrate that machine learning is capable of accurately detecting mutations of known worms

Subjective and objective interpretation of tear film interferometry images

Background: Assessment of the tear film is necessary in routine clinical practice because an unstable tear film can hamper the quality of life by causing vision-related problems and compromising the ocular surface. One of the major concerns related to an unstable tear film is dry eye. Many of dry eye patients suffer from a lack of meibum which forms the lipid layer of the tear film. The lipid layer can be graded and interpreted by using interferometry. However, interpretation and grading of this dynamic layer may be inconsistent in terms of inter- and intra- observations. This study investigated the difficulty of consistent, subjective grading of clinical findings, in general.Methods: The interferometry images of 30 subjects captured from different equipment were analyzed subjectively. The agreement between intra-observer repeatability was also measured.Results: A positive Spearman’s correlation of 0.81 was found among different grading patterns observed using the Tearsope to compare right and left eyes. Similarly, a positive Spearman’s correlation of 0.63 was found among different grading patterns observed under interferometer in right and left eye. Correlations were statistically significant, p<0.001. The agreement between intra-observer repeatability calculated using Cohen’s kappa values were also statistically significant, p<0.001.Conclusions: A correlation between the findings of different equipment could not be made due to the differences in wavelengths of incident light and the image details. However, a new grading pattern has been proposed to describe the thickness of various lipid layer patterns observed under Doane’s interferometer

Father-Son Chats: Inheriting Stress through Sperm RNA

Although mounting evidence in mammals suggests that certain ancestral environmental exposures can influence the phenotype in future generations, mechanisms underlying such intergenerational information transfer remain unclear. A recent report suggests that RNA isolated from sperm can inform offspring of a father’s history of early life trauma (Gapp et al., 2014)

Towards verifying correctness of wireless sensor network applications using Insense and Spin

The design and implementation of wireless sensor network applications often require domain experts, who may lack expertise in software engineering, to produce resource-constrained, concurrent, real-time software without the support of high-level software engineering facilities. The Insense language aims to address this mismatch by allowing the complexities of synchronisation, memory management and event-driven programming to be borne by the language implementation rather than by the programmer. The main contribution of this paper is all initial step towards verifying the correctness of WSN applications with a focus on concurrency. We model part of the synchronisation mechanism of the Insense language implementation using Promela constructs and verify its correctness using SPIN. We demonstrate how a previously published version of the mechanism is shown to be incorrect by SPIN, and give complete verification results for the revised mechanism.Preprin

Bearing Fault Evaluation for Structural Health Monitoring, Fault Detection, Failure Prevention and Prognosis

AbstractIn this work the two disciplines of condition based maintenance (CBM), structural health monitoring (SHM) and prognostics are described fault identification and estimation is an important and necessary step in condition based maintenance. In the present work, an experiment is carried out with a customized test setup where the seeded defects are introduced in the inner race and outer race of a radial ball bearing. The relationship between the acquired vibration data and their relation with the seeded defect is found in this paper. When experiment is performed on the test setup designed for Fault prediction, Analytical Wavelet Transform proved an effective tool for the analysis of vibration signal. In this work, AWT followed by the Power Spectral Density is implemented on vibration signals of a defective Radial Ball Bearing. After finding the fault, its location and its intensity Ball Bearing's remaining useful life is estimated